Integrate Wiz with Google SecOps

This document explains how to integrate Wiz with Google Security Operations (Google SecOps).

Integration version: 1.0

Before you begin

To use the integration, you need an API Root, Client ID, and Client Secret.

For more information on how to generate these credentials, see Service Accounts settings .

Integration parameters

The Wiz integration requires the following parameters:

For instructions about how to configure an integration in Google SecOps, see Configure integrations .

You can make changes at a later stage, if needed. After you configure an integration instance, you can use it in playbooks. For more information about how to configure and support multiple instances, see Supporting multiple instances .

Actions

For more information about actions, see Respond to pending actions from Your Workdesk and Perform a manual action .

Ping

Use the Pingaction to test the connectivity to Wiz.

This action doesn't run on Google SecOps entities.

Action inputs

None.

Action outputs

The Pingaction provides the following outputs:

Output messages

The Pingaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Pingaction:

Get Issue Details

Use the Get Issue Detailsaction to obtain information about a specified issue in Wiz.

This action doesn't run on Google SecOps entities.

Action inputs

The Get Issue Detailsaction requires the following parameters:

Action outputs

The Get Issue Detailsaction provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Get Issue Detailsaction:

  { 
  
 "id" 
 : 
  
 "f54e3fb9-a520-4e99-aacc-b99f6ae7f28d" 
 , 
  
 "createdAt" 
 : 
  
 "2025-07-26T11:47:43.94524Z" 
 , 
  
 "updatedAt" 
 : 
  
 "2025-07-31T07:34:54.445702Z" 
 , 
  
 "status" 
 : 
  
 "RESOLVED" 
 , 
  
 "severity" 
 : 
  
 "CRITICAL" 
 , 
  
 "type" 
 : 
  
 "TOXIC_COMBINATION" 
 , 
  
 "description" 
 : 
  
 "This container is using an image that contains a file identified as a high/critical severity malware by ReversingLabs.\n\nMalware can imply a malicious actor's presence in your environment. The malware can be used for crypto-mining, data leakage, lateral movement to other resources in your environment, etc." 
 , 
  
 "resolvedAt" 
 : 
  
 "2025-07-31T07:34:54.445702Z" 
 , 
  
 "entitySnapshot" 
 : 
  
 { 
  
 "cloudPlatform" 
 : 
  
 "GCP" 
 , 
  
 "id" 
 : 
  
 "1971f945-3476-5b3d-a5a1-ab166c3e2eca" 
 , 
  
 "name" 
 : 
  
 "cluster-solr" 
 , 
  
 "region" 
 : 
  
 "us-central1" 
 , 
  
 "subscriptionName" 
 : 
  
 "Wiz-Labs" 
 , 
  
 "type" 
 : 
  
 "KUBERNETES_CLUSTER" 
  
 }, 
  
 "projects" 
 : 
  
 [ 
  
 { 
  
 "id" 
 : 
  
 "904cbc14-1c52-571c-a6b8-46fee263eb0f" 
 , 
  
 "name" 
 : 
  
 "GCP Lab" 
  
 } 
  
 ], 
  
 "sourceRules" 
 : 
  
 [ 
  
 { 
  
 "id" 
 : 
  
 "wc-id-1038" 
 , 
  
 "name" 
 : 
  
 "Container using an image infected with critical/high severity malware" 
 , 
  
 "description" 
 : 
  
 "This container is using an image that contains a file identified as a high/critical severity malware by ReversingLabs.\n\nMalware can imply a malicious actor's presence in your environment. The malware can be used for crypto-mining, data leakage, lateral movement to other resources in your environment, etc." 
  
 } 
  
 ] 
 } 
 

Output messages

The Get Issue Detailsaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Get Issue Detailsaction:

Reopen Issue

Use the Reopen Issueaction to reopen a specified issue in Wiz.

This action doesn't run on Google SecOps entities.

Action inputs

The Reopen Issueaction requires the following parameters:

Action outputs

The Reopen Issueaction provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Reopen Issueaction:

  { 
  
 "id" 
 : 
  
 "41facd3f-29b0-4fcf-9a0c-e7fc40416aa0" 
 , 
  
 "note" 
 : 
  
 "" 
 , 
  
 "status" 
 : 
  
 "OPEN" 
 , 
  
 "dueAt" 
 : 
  
 null 
 , 
  
 "resolutionReason" 
 : 
  
 null 
 } 
 

Output messages

The Reopen Issueaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Reopen Issueaction:

Ignore Issue

Use the Ignore Issueaction to ignore a specified issue in Wiz.

This action doesn't run on Google SecOps entities.

Action inputs

The Ignore Issueaction requires the following parameters:

Action outputs

The Ignore Issueaction provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Ignore Issueaction:

  { 
  
 "id" 
 : 
  
 "41facd3f-29b0-4fcf-9a0c-e7fc40416aa0" 
 , 
  
 "note" 
 : 
  
 "" 
 , 
  
 "status" 
 : 
  
 "REJECTED" 
 , 
  
 "dueAt" 
 : 
  
 null 
 , 
  
 "resolutionReason" 
 : 
  
 "FALSE_POSITIVE" 
 } 
 

Output messages

The Ignore Issueaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Ignore Issueaction:

Resolve Issue

Use the Resolve Issueaction to resolve a specified issue in Wiz.

This action doesn't run on Google SecOps entities.

Action inputs

The Resolve Issueaction requires the following parameters:

Action outputs

The Resolve Issueaction provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Resolve Issueaction:

  { 
  
 "id" 
 : 
  
 "0db2222f-7d1f-501a-9ad5-fe669c7da036" 
 , 
  
 "resolutionNote" 
 : 
  
 "" 
 , 
  
 "status" 
 : 
  
 "RESOLVED" 
 , 
  
 "dueAt" 
 : 
  
 null 
 , 
  
 "resolutionReason" 
 : 
  
 "NOT_MALICIOUS_THREAT" 
 } 
 

Output messages

The Resolve Issueaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Resolve Issueaction:

Add Comment To Issue

Use the Add Comment To Issueaction to add a comment to a specified issue in Wiz.

This action doesn't run on Google SecOps entities.

Action inputs

The Add Comment To Issueaction requires the following parameters:

Action outputs

The Add Comment To Issueaction provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Add Comment To Issueaction:

  { 
  
 "createdAt" 
 : 
  
 "2025-08-01T11:59:00.843434941Z" 
 , 
  
 "id" 
 : 
  
 "6f997da2-85a0-4be2-b205-83ea19e9b17a" 
 , 
  
 "text" 
 : 
  
 "testing" 
 } 
 

Output messages

The Add Comment To Issueaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Add Comment To Issueaction:

Need more help? Get answers from Community members and Google SecOps professionals.